Skip to main content

Biometric and Face-Related Features

This page covers AI features that identify, verify, categorize, or infer traits from face or biometric data.

Why classification varies here​

Biometric use carries elevated fundamental-rights and surveillance risks. Some uses are prohibited outright, some are regulated as high-risk, and some mainly trigger transparency obligations. Exact classification depends on concrete context and purpose, not feature naming.

Verification is not remote identification

Biometric verification = one-to-one confirmation that a person is who they claim to be (Art 3(36)) — excluded from "remote biometric identification." Remote biometric identification = one-to-many matching without the person's active involvement (Art 3(41)). The two carry very different obligations, so classify precisely.

Prohibited biometric practices (Art 5)
  • Untargeted scraping of facial images to build recognition databases (Art 5(1)(e)).
  • Emotion inference in the workplace or education (Art 5(1)(f)), outside medical/safety use.
  • Biometric categorisation inferring sensitive attributes — race, political opinions, religion, sexual orientation, etc. (Art 5(1)(g)).
  • Real-time remote biometric identification in public spaces for law enforcement, narrow exceptions only (Art 5(1)(h)).
caution

Biometric categorisation (Art 3(40)) and emotion recognition (Art 3(39)) that are not prohibited are Annex III high-risk — they still require the full high-risk controls plus the Art 50(3) notice to exposed persons.

Required obligations​

WHEN​

  • A feature processes facial/biometric signals for identification, verification, categorization, or inferred traits.
  • Scope, context, model behavior, or data source changes in a way that changes biometric impact.

MUST​

  • Run prohibited-practice screening first and block release if matched.
  • Treat real-time remote biometric identification as generally prohibited, aside from narrow legal exceptions outside normal commercial product scope.
  • If not prohibited, assess for high-risk scope and complete required controls before release.
  • Implement required notices/disclosures in covered biometric or emotion-recognition scenarios.

OUTPUT artifacts​

  • Prohibited-screening result with legal/compliance sign-off.
  • High-risk determination record and release approval (if applicable).
  • Evidence of required notices/disclosures where transparency duties apply.
Real-world illustration

Clearview AI: built a facial-recognition database by scraping billions of images from the web, drawing GDPR fines across Europe — €30.5M (Netherlands, 2024), £7.5M (UK, 2022 — later overturned on jurisdiction grounds on appeal), €20M (Italy, 2022). Decided under GDPR, not the AI Act, but it mirrors exactly the untargeted-scraping practice that Art 5(1)(e) now prohibits. (Dutch DPA)